# GitHub Copilot Sandboxing GitHub Copilot Sandboxing is [[GitHub]]'s answer to the "agent with full shell access" problem: two complementary isolation modes for running [[GitHub Copilot CLI]] agent sessions, both in public preview. **Local sandboxing** wraps the commands an agent runs on your machine in an OS-level sandbox powered by [[Microsoft eXecution Container (MXC)]]. **Cloud sandboxing** moves the whole session off your machine into an ephemeral, GitHub-hosted Linux environment built on Azure Container Apps Sandboxes. ## Local sandboxing Runs shell commands, built-in searches, and local MCP/LSP servers as sandboxed child processes, enforced by the OS via MXC's per-platform backends: Seatbelt on macOS, Bubblewrap on Linux, ProcessContainer on Windows (Insiders builds only). Enable with `--experimental`. The policy model is **deny-by-default** with automatic grants assembled per command: - The working directory gets read/write (default), the rest of a [[Git]] repository gets read-only - Tools on `PATH` (plus `GOPATH`, `CARGO_HOME`, `PYTHONPATH`) get read-only, so commands can't modify their own dependencies - System locations and the home directory get read-only; package manager caches get read/write - Network: outbound internet and local network are controlled independently - Credentials ([[Git]], `gh`), macOS keychain access, and per-command sandbox exceptions are all configurable - Overlaps resolve by specificity ("the more specific path wins"), and user config always beats automatic grants. Enterprise-managed settings ([[GitHub Copilot Managed Settings]]) compose in the most restrictive direction: the enterprise sets a floor users can tighten but never loosen Inspect with `/sandbox policy` and `/sandbox status`, configure with `/sandbox config`. **One big caveat**: the CLI's built-in file tools run in-process, and the CLI itself is not sandboxed, so the OS never sees those file operations. They honor the policy in software only, on a best-effort basis. Same class of caveat as MXC's own "not a security boundary yet" warning. ## Cloud sandboxing Each session runs in a fully isolated, ephemeral Linux VM on GitHub's infrastructure (`--cloud --experimental`). Sessions are snapshotted (files, environment variables, in-progress work) and can be resumed from any device. Also available when starting agent sessions from the [[GitHub Copilot App]]. Usage-billed (compute per second, memory per GiB-second, storage per GiB-month) versus local sandboxing which is included in the seat. Interactive sessions only; programmatic use is unsupported. Organizations must enable the Cloud Sandbox access policy. ## How it compares The sandboxing space splits by *where the boundary sits*: | Option | Boundary | Where it runs | Positioning | |--------|----------|---------------|-------------| | Copilot local sandboxing ([[Microsoft eXecution Container (MXC)|MXC]]) | OS process sandbox (Seatbelt/Bubblewrap/ProcessContainer) | Your machine | Policy on the agent's commands, lightest-weight isolation | | Copilot cloud sandboxing | Hosted ephemeral VM | GitHub cloud | Remove your machine from the blast radius entirely | | [[Docker Sandboxes]] | [[microVM]] per session (own kernel, private Docker daemon) | Your machine | VM-grade isolation locally, agent-agnostic (works with Copilot too) | | [[Windows Sandbox]] | [[Hyper-V]] container-VM hybrid | Your machine | Disposable full Windows desktop, not agent-specific; also an experimental MXC backend | | [[OpenSandbox]] | Pluggable runtimes (Docker, K8s, [[gVisor]], Kata, Firecracker) | Self-hosted | Open-source agent execution *platform*: lifecycle, credential vault, egress policy | | [[Cloudflare Sandbox SDK]] | [[Cloudflare Containers]] instance | Cloudflare edge | Managed sandbox-as-API for agents you build, addressable from Workers | | [[Vercel Sandboxes]] | [[microVM]] | Vercel cloud | Managed sandbox-as-API in the Vercel platform, secrets injected from outside | The key distinction: Copilot sandboxing secures *GitHub's own agent* for its users, while Docker Sandboxes secures *any local agent*, and OpenSandbox, Cloudflare, and Vercel are infrastructure for agents *you* build. And within Copilot itself: local sandboxing is a process-level policy (weaker, free, fast), cloud sandboxing is full machine isolation (stronger, billed, portable sessions). ## References - Concepts, cloud and local sandboxes: https://docs.github.com/en/copilot/concepts/about-cloud-and-local-sandboxes - Concepts, understanding local sandboxing: https://docs.github.com/en/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing - How-to hub: https://docs.github.com/en/copilot/how-tos/cloud-and-local-sandboxes - Using local sandboxing: https://docs.github.com/en/copilot/how-tos/cloud-and-local-sandboxes/using-local-sandboxing - Configuring local sandbox settings: https://docs.github.com/en/copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings - Enabling/disabling cloud sandboxes (org/enterprise): https://docs.github.com/en/copilot/how-tos/cloud-and-local-sandboxes/enabling-or-disabling-cloud-sandboxes-for-your-organization - Billing: https://docs.github.com/en/billing/concepts/product-billing/cloud-and-local-sandboxes - Public preview announcement: https://github.blog/changelog/2026-06-02-cloud-and-local-sandboxes-for-github-copilot-now-in-public-preview/ - MXC: https://github.com/microsoft/mxc ## Related - [[GitHub Copilot]] - [[GitHub Copilot CLI]] - [[GitHub Copilot App]] - [[Microsoft eXecution Container (MXC)]] - [[Docker Sandboxes]] - [[Windows Sandbox]] - [[OpenSandbox]] - [[Cloudflare Sandbox SDK]] - [[Vercel Sandboxes]] - [[Sandcastle (AI)]] - [[AI Agents]] - [[AI Agent Permissions]] - [[GitHub Copilot Managed Settings]] - [[Lethal Trifecta for AI Agents]] - [[microVM]]